diff options
author | Ludovic Courtès <ludo@gnu.org> | 2015-05-11 22:21:31 +0200 |
---|---|---|
committer | Ludovic Courtès <ludo@gnu.org> | 2015-05-11 23:01:20 +0200 |
commit | 1303a4a4517260def862ce7fe97e6b28dd8005e1 (patch) | |
tree | 1aa55bda57bd4ff8f951bf4aa5a84045eae220f5 /nix/libstore | |
parent | 2320ea1a51ce707ca19967f50e6fbedefafe14c4 (diff) | |
download | gnu-guix-1303a4a4517260def862ce7fe97e6b28dd8005e1.tar gnu-guix-1303a4a4517260def862ce7fe97e6b28dd8005e1.tar.gz |
daemon: Fix possible use-after-free.
This is essentially a backport of
<https://github.com/NixOS/nix/commit/f52b6c944e90b3e35925122779175705fdc02e12>
by Eelco Dolstra <eelco.dolstra@logicblox.com>.
The use-after-free bug would typically manifest when building with
GCC 5.1.
Diffstat (limited to 'nix/libstore')
-rw-r--r-- | nix/libstore/build.cc | 29 |
1 files changed, 7 insertions, 22 deletions
diff --git a/nix/libstore/build.cc b/nix/libstore/build.cc index f38cd29940..b3c994d6de 100644 --- a/nix/libstore/build.cc +++ b/nix/libstore/build.cc @@ -401,18 +401,6 @@ static void commonChildInit(Pipe & logPipe) } -/* Convert a string list to an array of char pointers. Careful: the - string list should outlive the array. */ -const char * * strings2CharPtrs(const Strings & ss) -{ - const char * * arr = new const char * [ss.size() + 1]; - const char * * p = arr; - foreach (Strings::const_iterator, i, ss) *p++ = i->c_str(); - *p = 0; - return arr; -} - - /* Restore default handling of SIGPIPE, otherwise some programs will randomly say "Broken pipe". */ static void restoreSIGPIPE() @@ -2135,11 +2123,7 @@ void DerivationGoal::initChild() Strings envStrs; foreach (Environment::const_iterator, i, env) envStrs.push_back(rewriteHashes(i->first + "=" + i->second, rewritesToTmp)); - const char * * envArr = strings2CharPtrs(envStrs); - - Path program = drv.builder.c_str(); - std::vector<const char *> args; /* careful with c_str()! */ - string user; /* must be here for its c_str()! */ + std::vector<const char *> envArr = stringsToCharPtrs(envStrs); /* If we are running in `build-users' mode, then switch to the user we allocated above. Make sure that we drop all root @@ -2165,17 +2149,18 @@ void DerivationGoal::initChild() } /* Fill in the arguments. */ + Strings args; string builderBasename = baseNameOf(drv.builder); args.push_back(builderBasename.c_str()); foreach (Strings::iterator, i, drv.args) - args.push_back(rewriteHashes(*i, rewritesToTmp).c_str()); - args.push_back(0); + args.push_back(rewriteHashes(*i, rewritesToTmp)); + std::vector<const char *> argArr = stringsToCharPtrs(args); restoreSIGPIPE(); /* Execute the program. This should not return. */ inSetup = false; - execve(program.c_str(), (char * *) &args[0], (char * *) envArr); + execve(drv.builder.c_str(), (char * *) &argArr[0], (char * *) &envArr[0]); throw SysError(format("executing `%1%'") % drv.builder); @@ -2778,7 +2763,7 @@ void SubstitutionGoal::tryToRun() args.push_back("--substitute"); args.push_back(storePath); args.push_back(destPath); - const char * * argArr = strings2CharPtrs(args); + std::vector<const char *> argArr = stringsToCharPtrs(args); /* Fork the substitute program. */ pid = maybeVfork(); @@ -2796,7 +2781,7 @@ void SubstitutionGoal::tryToRun() if (dup2(outPipe.writeSide, STDOUT_FILENO) == -1) throw SysError("cannot dup output pipe into stdout"); - execv(sub.c_str(), (char * *) argArr); + execv(sub.c_str(), (char * *) &argArr[0]); throw SysError(format("executing `%1%'") % sub); |